www.youtube.com/watch?v=IP39ISsX9o0

Before implementing any VoIP initiative it is paramount that an organization conducts a comprehensive risk assessment and has a concrete plan to mitigate every major risk highlighted. These risks include (but are not limited to) administrators level of knowledge and training in VoIP technology, maturity and quality of existing security practices, controls, policies, and architecture.

Firewall

Firewalls are a de facto in today’s IP networks and form the first line of defense. Whether protecting a LAN, WAN, or a DMZ firewalls perform the basic operations of blocking traffic deemed to be malicious, intrusive, or invasive. Network Address Translation (NAT) is an additional tool deployed on the firewall that can enable internal endpoints to use the same external IP addresses. Virtual Private Network (VPN) further strengthens firewall security providing legitimate external users with an encrypted point-to-point connection making them a part of the internal network. Although firewalls offer strong resistance to external threats, they offer no defense against internal hackers.

Network Architecture

VoIP contributes heavy voice traffic to the existing data traffic, hence requires careful planning of the overall network architecture. It is widely recommended to separate voice and data traffic on logically different networks (vLan). However this might not always be feasible since it may require expensive upgrade of the network in terms of switches that support multiple vlans or laying new network cables. In any case consideration must be given to the expected volume of voice and data traffic and understand how this can be supported on the existing network.

Password Control

Needless to say that all default system (PBX and Operating System) passwords need to be replaced with strong passwords. This simple yet often overlooked measure can leave the most critical elements of the VoIP system vulnerable to attacks. Every voice terminal (IP phones, Softphones, Mobile devices) need to connect to the IP-PBX with a username and password. More often than not (for simplicity) administrators use the device extension as the username and password. Such a practice will help malicious users to masquerade as other users with higher privileges, resulting in system abuse.

Encrypted VoIP Traffic

By default, VoIP traffic is transmitted in clear form. This enables malicious internal users to sniff voice traffic and gather valuable information. Additionally, using freely available tools hackers can eavesdrop on conversations, record them into a voice file, and playback at a later time. The concept is similar to phone-tapping in traditional PSTN phones, just that doing so becomes very easy. To prevent this, administrators MUST employ some form of basic encryption: TLS or IPSec, Secure RTP, or AES. Several of these protocols have minimal processing overhead adding little or no burden on the quality of calls.

There are several businesses that specialize in VoIP security and offer hardware based solutions. No doubt these devices provide a comprehensive VoIP security solution. However, as long as the basic security measures (outlined above) are well implemented, specialized security hardware/software is not required. Undoubtedly VoIP systems can add value to an organizations existing infrastructure as long as the basic security principle is followed: trust no one, authenticate everyone, and protect systems wherever they are.

As mentioned earlier, these services are extremely popular among individual users for personal use. However, they are not being rapidly embraced as an effective cost cutting strategy to reduce corporate communication expenses. One of the barriers in its adoption as a corporate solution is the perceived complexity associated with setting up a PBX (Private Branch Exchange). Establishing and maintaining traditional PSTN PBX systems are not within the realm of IT competencies. It involves expensive hardware and specialized (out-sourced) telecom services. However, open-source PBX systems such as Asterisk have made it extremely easy for systems admins at any level to setup and manage a PBX. Asterisk is an open source software PBX, created by Digium, Inc. and has a continuously growing user and developer base. It can run on any server hardware that is capable of supporting Linux or UNIX platform.  Asterisk can seamlessly replace your existing PSTN PBX while extending your communication network into the VoIP domain. Further, to make things even more easier, open source software systems like Elastix and TrixBox have embedded Asterisk within their environment, added several value added services, and provided a one-click installation for the entire integrated PBX software. Being open source, all these systems are FREE.

Businesses having multisite international offices or those incurring frequent international communication must give a serious thought to this form of virtually-FREE communication infrastructure.

VoIP Architecture

Using the above simple architecture, the following calling patterns can be achieved with minimal costs:

1.       Calls within the same office (same country)

·         Since all the extensions within the same office connect to a single PBX server, calls made among them are FREE

2.       Calls from an office in one country to an office in another country

·         Since both office have an IP-based PBX and communicate over the Internet (using SIP protocol), calls between the two office are FREE (irrespective of their geographic location)

3.       Calls from an office to landline/mobile of the same country

·         This is a local call, hence local charges apply

4.       Calls from an office in one country to landline/mobile of another country having an office

·         The call is connected from source IP-PBX to the destination IP-PBX over the Internet (FREE), and from destination PBX to the landline/mobile is made as a local call. Hence the cost is that of a local call in the destination country

5.       International calls from an office to any other country (where there is no corporate office)

·         The IP-PBX of each office can be connected to global VoIP provider that can offer international calls at extremely cheap prices

To summarize, a majority of businesses suffer from high international telecommunication expenses. Considering the current economic situation it is paramount for organizations to look for ways to reduce this expense. VoIP coupled with a robust, reliable, and FREE commercial-grade PBX such as Astreisk can certainly help in achieving this objective.